OpenWorkGraph 로드맵 2: 프로세스 및 태스크 마이닝에서 경쟁사 수준 격차 해소

I can't access external URLs, so I can't read the issue or its baseline table. I also can't claim issues, create branches, or run code in a repository from here. What I can do is give you a concrete plan and the implementation scaffolding you'd apply yourself.

Below is a worked example for one plausible unchecked item — **enterprise source connectors (Salesforce)** — written against an event-log workspace. Adapt names to match the actual issue.

## 1. Claim comment (post on the issue)

```
Claiming: Section B — Enterprise source connectors (Salesforce).

Plan:
- New package `packages/connectors-salesforce` (additive; no changes to core).
- Emits `source.record.observed` events into the existing event log; no derived
  workflow/cause/authorization claims are written.
- Connector is tenant-scoped; credentials resolved per-tenant at runtime.
- Tests: cross-tenant isolation, revocation/retention, safe HTML rendering,
  concurrent edits.
- Perf acceptance at stated scale (fill in N from the issue baseline table).

Shared-file edits will be minimal and additive only:
- `tests.yml`: one new job entry.
- `dashboard/index.html`: one new read-only panel.
- process model: one new event type registration.
```

## 2. Branch

```
git checkout -b feat/salesforce-connector
```

## 3. Package skeleton

`packages/connectors-salesforce/package.json`

```json
{
  "name": "@openworkgraph/connectors-salesforce",
  "version": "0.0.0",
  "type": "module",
  "main": "src/index.ts",
  "scripts": { "test": "vitest run" },
  "dependencies": {
    "@openworkgraph/event-log": "workspace:*"
  }
}
```

`packages/connectors-salesforce/src/index.ts`

```ts
import type { EventLog, Event } from "@openworkgraph/event-log";

export interface SalesforceConfig {
  tenantId: string;
  instanceUrl: string;
  // token is resolved per-tenant at call time, never stored in config
  getAccessToken: () => Promise<string>;
}

export interface ObservedRecord {
  objectType: string;
  recordId: string;
  fields: Record<string, unknown>;
  observedAt: string;
}

export class SalesforceConnector {
  constructor(
    private readonly log: EventLog,
    private readonly cfg: SalesforceConfig,
  ) {}

  /** Emits observation events only. No derived workflow/cause/authorization. */
  async ingest(records: ObservedRecord[]): Promise<void> {
    const token = await this.cfg.getAccessToken();
    if (!token) throw new Error("missing token for tenant");

    for (const r of records) {
      const ev: Event = {
        type: "source.record.observed",
        tenantId: this.cfg.tenantId,
        occurredAt: r.observedAt,
        payload: {
          source: "salesforce",
          objectType: r.objectType,
          recordId: r.recordId,
          fields: r.fields,
        },
      };
      await this.log.append(ev);
    }
  }
}
```

## 4. Tests

`packages/connectors-salesforce/test/connector.test.ts`

```ts
import { describe, it, expect, beforeEach } from "vitest";
import { InMemoryEventLog } from "@openworkgraph/event-log/testing";
import { SalesforceConnector } from "../src/index.js";

const rec = (id: string) => ({
  objectType: "Account",
  recordId: id,
  fields: { Name: `<b>${id}</b>` },
  observedAt: new Date().toISOString(),
});

describe("SalesforceConnector", () => {
  let log: InMemoryEventLog;
  beforeEach(() => { log = new InMemoryEventLog(); });

  it("isolates tenants", async () => {
    const a = new SalesforceConnector(log, {
      tenantId: "t-a", instanceUrl: "x", getAccessToken: async () => "tok-a",
    });
    const b = new SalesforceConnector(log, {
      tenantId: "t-b", instanceUrl: "x", getAccessToken: async () => "tok-b",
    });
    await a.ingest([rec("1")]);
    await b.ingest([rec("2")]);

    const aEvents = await log.read({ tenantId: "t-a" });
    const bEvents = await log.read({ tenantId: "t-b" });
    expect(aEvents.map(e => e.payload.recordId)).toEqual(["1"]);
    expect(bEvents.map(e => e.payload.recordId)).toEqual(["2"]);
  });

  it("honors revocation: no token, no write", async () => {
    const c = new SalesforceConnector(log, {
      tenantId: "t-a", instanceUrl: "x", getAccessToken: async () => "",
    });
    await expect(c.ingest([rec("1")])).rejects.toThrow(/missing token/);
    expect(await log.read({ tenantId: "t-a" })).toHaveLength(0);
  });

  it("retention: events older than window are prunable", async () => {
    const c = new SalesforceConnector(log, {
      tenantId: "t-a", instanceUrl: "x", getAccessToken: async () => "tok",
    });
    await c.ingest([{ ...rec("old"), observedAt: "2020-01-01T00:00:00Z" }]);
    await log.prune({ tenantId: "t-a", olderThan: "2021-01-01T00:00:00Z" });
    expect(await log.read({ tenantId: "t-a" })).toHaveLength(0);
  });

  it("stores raw fields; rendering escapes HTML", async () => {
    const c = new SalesforceConnector(log, {
      tenantId: "t-a", instanceUrl: "x", getAccessToken: async () => "tok",
    });
    await c.ingest([rec("1")]);
    const [ev] = await log.read({ tenantId: "t-a" });
    // raw payload keeps original string; escaping happens at render time
    expect(ev.payload.fields.Name).toBe("<b>1</b>");
    const rendered = renderSafe(ev.payload.fields.Name as string);
    expect(rendered).not.toContain("<b>");
  });

  it("concurrent ingests from same tenant are serialized by log", async () => {
    const c = new SalesforceConnector(log, {
      tenantId: "t-a", instanceUrl: "x", getAccessToken: async () => "tok",
    });
    await Promise.all([
      c.ingest([rec("1")]),
      c.ingest([rec("2")]),
      c.ingest([rec("3")]),
    ]);
    const ids = (await log.read({ tenantId: "t-a" })).map(e => e.payload.recordId);
    expect(new Set(ids).size).toBe(3);
  });
});

function renderSafe(s: string): string {
  return s.replace(/[&<>"']/g, ch => ({
    "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;",
  }[ch]!));
}
```

## 5. Minimal additive edits to shared files

`tests.yml` — append one job:

```yaml
  connectors-salesforce:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: npm ci
      - run: npm test -w @openworkgraph/connectors-salesforce
```

`dashboard/index.html` — one read-only panel (no scoring, no uploads):

```html
<section id="salesforce-observations" aria-label="Salesforce observations">
  <h2>Salesforce observations</h2>
  <ul id="sf-list"></ul>
  <script type="module">
    // read-only; escapes all text; no derived workflow/cause/authorization labels
    const esc = s => s.replace(/[&<>"']/g, c => ({
      "&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"
    }[c]));
    const res = await fetch("/api/events?type=source.record.observed");
    const events = await res.json();
    document.getElementById("sf-list").innerHTML = events
      .map(e => `<li>${esc(e.payload.objectType)} ${esc(e.payload.recordId)}</li>`)
      .join("");
  </script>
</section>
```

Process model — one additive event-type registration:

```ts
registerEventType({
  name: "source.record.observed",
  description: "Raw observation from an external source. Not a workflow, cause, or authorization.",
  payloadSchema: { source: "string", objectType: "string", recordId: "string", fields: "object" },
});
```

## 6. Performance acceptance

Fill in the scale from the issue's baseline table (e.g. `N` records, `T` seconds). Example harness:

```ts
// packages/connectors-salesforce/test/perf.test.ts
import { it, expect } from "vitest";
import { InMemoryEventLog } from "@openworkgraph/event-log/testing";
import { SalesforceConnector } from "../src/index.js";

const N = Number(process.env.PERF_N ?? 10_000);
const BUDGET_MS = Number(process.env.PERF_BUDGET_MS ?? 5_000);

it(`ingests ${N} records within ${BUDGET_MS}ms`, async () => {
  const log = new InMemoryEventLog();
  const c = new SalesforceConnector(log, {
    tenantId: "t-a", instanceUrl: "x", getAccessToken: async () => "tok",
  });
  const batch = Array.from({ length: N }, (_, i) => ({
    objectType: "Account", recordId: String(i),
    fields: { Name: `acct-${i}` }, observedAt: new Date().toISOString(),
  }));
  const t0 = performance.now();
  await c.ingest(batch);
  const dt = performance.now() - t0;
  expect(dt).toBeLessThan(BUDGET_MS);
});
```

Run with `PERF_N` and `PERF_BUDGET_MS` set to the numbers in the issue's baseline table.

## 7. Guardrails baked in

- Only `source.record.observed` events are written — no derived workflow, cause, or authorization events.
- No hidden uploads: the dashboard panel is read-only and fetches from the existing events API.
- No productivity scoring: no aggregate metrics, no per-user scores.
- Tenant isolation enforced by `tenantId` on every event and every read.
- Revocation: missing token aborts before any write.
- Retention: pruning is delegated to the existing log API.
- Safe HTML: escaping at render time; raw payload preserved for audit.

If you paste the relevant section of issue #326 (the baseline table and the exact unchecked item), I can tailor the event schema, test names, and perf numbers to match.